jenkins-ci has 18 CVEs on record. Disclosures have slowed: 0 in the last 90 days after 18 in the 90 before. The busiest recent month was June 2026 with 18. The median CVSS is 5.4 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (5) and CWE-352 (4). Most affected products: org.jenkins-ci.plugins:assembla (3), org.jenkins-ci.plugins:gitee (3), org.jenkins-ci.plugins:script-security (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 0 prev 18
Products
- org.jenkins-ci.plugins:assembla 3
- org.jenkins-ci.plugins:gitee 3
- org.jenkins-ci.plugins:script-security 2
- org.jenkins-ci.plugins:PrioritySorter 1
- org.jenkins-ci.plugins:active-directory 1
- org.jenkins-ci.plugins:contrast-continuous-application-security 1
Worst active — by depth score
CVE-2026-57301High· 8.8Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE49CVE-2026-57296High· 8.8Jenkins External Workspace Manager Plugin has a path traversal vulnerability49CVE-2026-57280High· 8.8Jenkins Script Security Plugin sandbox bypass vulnerability49CVE-2026-57281High· 7.5Jenkins Script Security Plugin has a script security bypass vulnerability41CVE-2026-57303High· 7.1Jenkins Assembla Plugin has an XXE vulnerability39
jenkins-ci vulnerabilities
CVEs affecting jenkins-ci, newest first. Open any entry for full detail, references, and exploit status.
18 CVEsRSS
CVE-2026-57301High· 8.8Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE
Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE
CVE-2026-57303High· 7.1Jenkins Assembla Plugin has an XXE vulnerability
Jenkins Assembla Plugin has an XXE vulnerability
CVE-2026-57302Medium· 4.3Jenkins FitNesse Plugin stores passwords unencrypted
Jenkins FitNesse Plugin stores passwords unencrypted
CVE-2026-57305Medium· 5.4Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability
Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability
CVE-2026-57304Medium· 5.4Jenkins Assembla Plugin has a missing permission check
Jenkins Assembla Plugin has a missing permission check
CVE-2026-57296High· 8.8Jenkins External Workspace Manager Plugin has a path traversal vulnerability
Jenkins External Workspace Manager Plugin has a path traversal vulnerability
CVE-2026-57288Low· 3.7Jenkins Active Directory Plugin has an LDAP injection vulnerability
Jenkins Active Directory Plugin has an LDAP injection vulnerability
CVE-2026-57293Medium· 4.3Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
CVE-2026-57292Medium· 5.4Jenkins Gitee Plugin has a cross-site request forgery vulnerability
Jenkins Gitee Plugin has a cross-site request forgery vulnerability
CVE-2026-57290Medium· 4.3Jenkins Priority Sorter Plugin has a CSRF vulnerability
Jenkins Priority Sorter Plugin has a CSRF vulnerability
CVE-2026-57298Medium· 5.4Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
CVE-2026-57291Medium· 5.4Jenkins Gitee Plugin missing permission checks
Jenkins Gitee Plugin missing permission checks
CVE-2026-57280High· 8.8Jenkins Script Security Plugin sandbox bypass vulnerability
Jenkins Script Security Plugin sandbox bypass vulnerability
CVE-2026-57281High· 7.5Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins Script Security Plugin has a script security bypass vulnerability
CVE-2026-57286Medium· 4.3Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
CVE-2026-57282Medium· 5.0Jenkins Git client Plugin has an OS command injection vulnerability on agents
Jenkins Git client Plugin has an OS command injection vulnerability on agents
CVE-2026-57285Medium· 4.3Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
CVE-2026-57287Medium· 4.3Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations